Windows Phone Link Exploited by CloudZ RAT to Steal Credentials and OTPs

Cisco Talos revealed a novel attack using CloudZ RAT and Pheno plugin to steal credentials and OTPs by exploiting Microsoft Phone Link.

• •Pheno plugin hijacks Phone Link's PC-to-phone bridge to intercept SMS and OTPs without deploying mobile malware
• •Initial infection uses fake ConnectWise ScreenConnect executable downloading a .NET loader with PowerShell persistence mechanism
• •CloudZ trojan establishes encrypted C2 connection and supports commands for credential exfiltration and browser data theft
• •Pheno accesses Phone Link's SQLite database to collect and transmit synchronized phone data
• •Attack active since January 2026, attributed to unknown threat actors

This summary was automatically generated by AI based on the original article and may not be fully accurate.